392 lines
12 KiB
TypeScript
392 lines
12 KiB
TypeScript
import type { ApiSettings } from "../types";
|
|
|
|
const STORAGE_KEY = "multimailer.apiSettings";
|
|
const LEGACY_STORAGE_KEYS = ["i18n:govoplan-core.multimailer_apisettings.1d1601d4"];
|
|
const SESSION_STORAGE_KEY = "multimailer.session";
|
|
const CSRF_COOKIE_NAME = import.meta.env.VITE_CSRF_COOKIE_NAME ?? "msm_csrf";
|
|
const RECENT_SAFE_REQUEST_TTL_MS = 750;
|
|
const MAX_RECENT_SAFE_REQUESTS = 100;
|
|
const MAX_CONDITIONAL_SAFE_REQUESTS = 200;
|
|
|
|
export const AUTH_REQUIRED_EVENT = "govoplan:auth-required";
|
|
|
|
export type AuthRequiredEventDetail = {
|
|
path: string;
|
|
status: number;
|
|
message: string;
|
|
};
|
|
|
|
type RecentSafeRequest = {
|
|
value: unknown;
|
|
expiresAt: number;
|
|
};
|
|
|
|
type ConditionalSafeRequest = {
|
|
value: unknown;
|
|
etag: string;
|
|
};
|
|
|
|
const inFlightSafeRequests = new Map<string, Promise<unknown>>();
|
|
const recentSafeRequests = new Map<string, RecentSafeRequest>();
|
|
const conditionalSafeRequests = new Map<string, ConditionalSafeRequest>();
|
|
let safeRequestGeneration = 0;
|
|
|
|
export class ApiError extends Error {
|
|
readonly status: number;
|
|
readonly statusText: string;
|
|
readonly body: string;
|
|
|
|
constructor(status: number, statusText: string, body: string) {
|
|
super(`${status} ${statusText}: ${body}`);
|
|
this.name = "ApiError";
|
|
this.status = status;
|
|
this.statusText = statusText;
|
|
this.body = body;
|
|
}
|
|
}
|
|
|
|
export function isApiError(error: unknown, ...statuses: number[]): error is ApiError {
|
|
return error instanceof ApiError && (statuses.length === 0 || statuses.includes(error.status));
|
|
}
|
|
|
|
/**
|
|
* API endpoint helpers already pass paths beginning with /api/v1. The configured
|
|
* value is therefore an origin only. Normalize legacy values that included the
|
|
* API prefix so old localStorage settings cannot produce /api/v1/api/v1 URLs.
|
|
*/
|
|
export function normalizeApiBaseUrl(value: string): string {
|
|
const trimmed = value.trim();
|
|
if (!trimmed || trimmed === "." || trimmed === "./") return "";
|
|
|
|
const withoutTrailingSlash = trimmed.replace(/\/+$/, "");
|
|
const withoutApiPrefix = withoutTrailingSlash.replace(/\/api(?:\/v1)?$/i, "");
|
|
|
|
// API base is an origin, not a frontend route prefix. Path-only values such
|
|
// as /a or . are stale/invalid local settings and would bypass Vite's /api
|
|
// proxy by producing /a/api/v1/... requests.
|
|
if (withoutApiPrefix.startsWith("/") && !withoutApiPrefix.startsWith("//")) {
|
|
return "";
|
|
}
|
|
|
|
return withoutApiPrefix;
|
|
}
|
|
|
|
export function apiUrl(settings: ApiSettings, path: string): string {
|
|
const baseUrl = normalizeApiBaseUrl(settings.apiBaseUrl);
|
|
const normalizedPath = path.startsWith("/") ? path : `/${path}`;
|
|
return baseUrl ? `${baseUrl}${normalizedPath}` : normalizedPath;
|
|
}
|
|
|
|
export function loadApiSettings(): ApiSettings {
|
|
const storedBaseUrl = loadStoredSetting("baseUrl");
|
|
const storedApiKey = sessionStorage.getItem(`${SESSION_STORAGE_KEY}.apiKey`);
|
|
const configuredBaseUrl = storedBaseUrl !== null ? storedBaseUrl : import.meta.env.VITE_API_BASE_URL ?? "";
|
|
const apiBaseUrl = normalizeApiBaseUrl(configuredBaseUrl);
|
|
|
|
// Repair legacy values once loaded, while keeping an empty value for same-origin use.
|
|
if (storedBaseUrl !== null && storedBaseUrl !== apiBaseUrl) {
|
|
localStorage.setItem(`${STORAGE_KEY}.baseUrl`, apiBaseUrl);
|
|
}
|
|
clearLegacyStoredSetting("baseUrl");
|
|
clearLegacyStoredSetting("apiKey");
|
|
localStorage.removeItem(`${STORAGE_KEY}.apiKey`);
|
|
|
|
localStorage.removeItem(`${STORAGE_KEY}.accessToken`);
|
|
sessionStorage.removeItem(`${SESSION_STORAGE_KEY}.accessToken`);
|
|
|
|
return {
|
|
// Empty base URL means "same origin". In Vite dev, /api is proxied to FastAPI.
|
|
apiBaseUrl,
|
|
apiKey: storedApiKey || "",
|
|
accessToken: ""
|
|
};
|
|
}
|
|
|
|
export function saveApiSettings(settings: ApiSettings): void {
|
|
localStorage.setItem(`${STORAGE_KEY}.baseUrl`, normalizeApiBaseUrl(settings.apiBaseUrl));
|
|
if (settings.apiKey) {
|
|
sessionStorage.setItem(`${SESSION_STORAGE_KEY}.apiKey`, settings.apiKey);
|
|
} else {
|
|
sessionStorage.removeItem(`${SESSION_STORAGE_KEY}.apiKey`);
|
|
}
|
|
clearLegacyStoredSetting("baseUrl");
|
|
clearLegacyStoredSetting("apiKey");
|
|
localStorage.removeItem(`${STORAGE_KEY}.apiKey`);
|
|
localStorage.removeItem(`${STORAGE_KEY}.accessToken`);
|
|
sessionStorage.removeItem(`${SESSION_STORAGE_KEY}.accessToken`);
|
|
}
|
|
|
|
export function clearAccessToken(): void {
|
|
sessionStorage.removeItem(`${SESSION_STORAGE_KEY}.accessToken`);
|
|
localStorage.removeItem(`${STORAGE_KEY}.accessToken`);
|
|
}
|
|
|
|
function loadStoredSetting(name: string): string | null {
|
|
const keys = [STORAGE_KEY, ...LEGACY_STORAGE_KEYS];
|
|
for (const key of keys) {
|
|
const value = localStorage.getItem(`${key}.${name}`);
|
|
if (value !== null) return value;
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function clearLegacyStoredSetting(name: string): void {
|
|
for (const key of LEGACY_STORAGE_KEYS) {
|
|
localStorage.removeItem(`${key}.${name}`);
|
|
}
|
|
}
|
|
|
|
|
|
function readCookie(name: string): string {
|
|
const prefix = `${encodeURIComponent(name)}=`;
|
|
return document.cookie.
|
|
split(";").
|
|
map((part) => part.trim()).
|
|
find((part) => part.startsWith(prefix))?.
|
|
slice(prefix.length) ?? "";
|
|
}
|
|
|
|
export function csrfToken(): string {
|
|
const value = readCookie(CSRF_COOKIE_NAME);
|
|
return value ? decodeURIComponent(value) : "";
|
|
}
|
|
|
|
function isUnsafeMethod(method?: string): boolean {
|
|
const normalized = (method || "GET").toUpperCase();
|
|
return !["GET", "HEAD", "OPTIONS", "TRACE"].includes(normalized);
|
|
}
|
|
|
|
function canReuseSafeRequest(method: string, init?: RequestInit): boolean {
|
|
return (method === "GET" || method === "HEAD") &&
|
|
!init?.body &&
|
|
!init?.signal &&
|
|
init?.cache !== "no-store" &&
|
|
init?.cache !== "reload";
|
|
}
|
|
|
|
function requestHeadersKey(headers: Headers): string {
|
|
return [...headers.entries()].
|
|
sort(([left], [right]) => left.localeCompare(right)).
|
|
map(([key, value]) => `${key}:${value}`).
|
|
join("\n");
|
|
}
|
|
|
|
function safeRequestKey(url: string, method: string, headers: Headers, init?: RequestInit): string {
|
|
return [
|
|
method,
|
|
url,
|
|
init?.credentials ?? "include",
|
|
init?.mode ?? "",
|
|
init?.redirect ?? "",
|
|
requestHeadersKey(headers)].
|
|
join("\n\n");
|
|
}
|
|
|
|
function pruneRecentSafeRequests(now = Date.now()): void {
|
|
for (const [key, entry] of recentSafeRequests) {
|
|
if (entry.expiresAt <= now) {
|
|
recentSafeRequests.delete(key);
|
|
}
|
|
}
|
|
|
|
while (recentSafeRequests.size > MAX_RECENT_SAFE_REQUESTS) {
|
|
const oldestKey = recentSafeRequests.keys().next().value;
|
|
if (!oldestKey) break;
|
|
recentSafeRequests.delete(oldestKey);
|
|
}
|
|
}
|
|
|
|
function recentSafeResponse(key: string): unknown | undefined {
|
|
const now = Date.now();
|
|
const recent = recentSafeRequests.get(key);
|
|
if (!recent) return undefined;
|
|
if (recent.expiresAt <= now) {
|
|
recentSafeRequests.delete(key);
|
|
return undefined;
|
|
}
|
|
return recent.value;
|
|
}
|
|
|
|
function rememberSafeResponse(key: string, value: unknown): void {
|
|
const now = Date.now();
|
|
recentSafeRequests.set(key, { value, expiresAt: now + RECENT_SAFE_REQUEST_TTL_MS });
|
|
pruneRecentSafeRequests(now);
|
|
}
|
|
|
|
function conditionalSafeResponse(key: string): ConditionalSafeRequest | undefined {
|
|
const cached = conditionalSafeRequests.get(key);
|
|
if (!cached) return undefined;
|
|
conditionalSafeRequests.delete(key);
|
|
conditionalSafeRequests.set(key, cached);
|
|
return cached;
|
|
}
|
|
|
|
function rememberConditionalSafeResponse(key: string, etag: string, value: unknown): void {
|
|
conditionalSafeRequests.delete(key);
|
|
conditionalSafeRequests.set(key, { etag, value });
|
|
while (conditionalSafeRequests.size > MAX_CONDITIONAL_SAFE_REQUESTS) {
|
|
const oldestKey = conditionalSafeRequests.keys().next().value;
|
|
if (!oldestKey) break;
|
|
conditionalSafeRequests.delete(oldestKey);
|
|
}
|
|
}
|
|
|
|
function clearSafeRequestCaches(): void {
|
|
safeRequestGeneration += 1;
|
|
inFlightSafeRequests.clear();
|
|
recentSafeRequests.clear();
|
|
conditionalSafeRequests.clear();
|
|
}
|
|
|
|
export function authHeaders(settings: ApiSettings): Headers {
|
|
const headers = new Headers();
|
|
if (settings.accessToken) {
|
|
headers.set("Authorization", `Bearer ${settings.accessToken}`);
|
|
} else if (settings.apiKey) {
|
|
headers.set("X-API-Key", settings.apiKey);
|
|
}
|
|
return headers;
|
|
}
|
|
|
|
function shouldNotifyAuthRequired(path: string): boolean {
|
|
const normalized = path.split("?", 1)[0].replace(/\/+$/, "");
|
|
return !normalized.endsWith("/auth/login");
|
|
}
|
|
|
|
function notifyAuthRequired(path: string): void {
|
|
if (typeof window === "undefined" || !shouldNotifyAuthRequired(path)) return;
|
|
const detail: AuthRequiredEventDetail = {
|
|
path,
|
|
status: 401,
|
|
message: "i18n:govoplan-core.your_session_has_expired_sign_in_again_to_contin.4cc6a1b3"
|
|
};
|
|
window.dispatchEvent(new CustomEvent<AuthRequiredEventDetail>(AUTH_REQUIRED_EVENT, { detail }));
|
|
}
|
|
|
|
function authExpiredError(statusText: string): ApiError {
|
|
return new ApiError(401, statusText || "i18n:govoplan-core.unauthorized.740b8315", "i18n:govoplan-core.your_session_has_expired_sign_in_again_to_contin.4cc6a1b3");
|
|
}
|
|
|
|
export async function apiFetch<T>(settings: ApiSettings, path: string, init?: RequestInit): Promise<T> {
|
|
const headers = new Headers(init?.headers || {});
|
|
const method = (init?.method || "GET").toUpperCase();
|
|
|
|
if (!(init?.body instanceof FormData) && !headers.has("Content-Type")) {
|
|
headers.set("Content-Type", "application/json");
|
|
}
|
|
|
|
for (const [key, value] of authHeaders(settings)) {
|
|
headers.set(key, value);
|
|
}
|
|
|
|
const csrf = csrfToken();
|
|
if (csrf && isUnsafeMethod(method) && !headers.has("X-CSRF-Token")) {
|
|
headers.set("X-CSRF-Token", csrf);
|
|
}
|
|
|
|
if (isUnsafeMethod(method)) {
|
|
clearSafeRequestCaches();
|
|
}
|
|
|
|
const url = apiUrl(settings, path);
|
|
const reusableSafeRequest = canReuseSafeRequest(method, init);
|
|
const cacheKey = reusableSafeRequest ? safeRequestKey(url, method, headers, init) : null;
|
|
|
|
async function runFetch(): Promise<T> {
|
|
const fetchHeaders = new Headers(headers);
|
|
const conditional = cacheKey ? conditionalSafeResponse(cacheKey) : undefined;
|
|
if (conditional && !fetchHeaders.has("If-None-Match")) {
|
|
fetchHeaders.set("If-None-Match", conditional.etag);
|
|
}
|
|
const fetchInit = { ...init, headers: fetchHeaders, credentials: init?.credentials ?? "include" };
|
|
const response = await fetch(url, fetchInit);
|
|
|
|
if (response.status === 304 && cacheKey && conditional) {
|
|
rememberSafeResponse(cacheKey, conditional.value);
|
|
return conditional.value as T;
|
|
}
|
|
|
|
if (!response.ok) {
|
|
const text = await response.text();
|
|
if (response.status === 401 && shouldNotifyAuthRequired(path)) {
|
|
notifyAuthRequired(path);
|
|
throw authExpiredError(response.statusText);
|
|
}
|
|
throw new ApiError(response.status, response.statusText, text);
|
|
}
|
|
|
|
if (response.status === 204) {
|
|
if (cacheKey) conditionalSafeRequests.delete(cacheKey);
|
|
return undefined as T;
|
|
}
|
|
|
|
const contentType = response.headers.get("content-type") || "";
|
|
let value: T;
|
|
if (!contentType.includes("application/json")) {
|
|
value = (await response.text()) as T;
|
|
} else {
|
|
value = (await response.json()) as T;
|
|
}
|
|
|
|
const etag = response.headers.get("etag");
|
|
if (cacheKey && etag) {
|
|
rememberConditionalSafeResponse(cacheKey, etag, value);
|
|
} else if (cacheKey) {
|
|
conditionalSafeRequests.delete(cacheKey);
|
|
}
|
|
return value;
|
|
}
|
|
|
|
if (!reusableSafeRequest || !cacheKey) {
|
|
return runFetch();
|
|
}
|
|
|
|
const requestGeneration = safeRequestGeneration;
|
|
const recent = recentSafeResponse(cacheKey);
|
|
if (recent !== undefined) {
|
|
return recent as T;
|
|
}
|
|
|
|
const existing = inFlightSafeRequests.get(cacheKey);
|
|
if (existing) {
|
|
return existing as Promise<T>;
|
|
}
|
|
|
|
const request = runFetch().
|
|
then((value) => {
|
|
if (requestGeneration === safeRequestGeneration) {
|
|
rememberSafeResponse(cacheKey, value);
|
|
}
|
|
return value;
|
|
}).
|
|
finally(() => {
|
|
if (inFlightSafeRequests.get(cacheKey) === request) {
|
|
inFlightSafeRequests.delete(cacheKey);
|
|
}
|
|
});
|
|
inFlightSafeRequests.set(cacheKey, request);
|
|
return request;
|
|
}
|
|
|
|
|
|
export async function apiDownload(settings: ApiSettings, path: string, filename: string): Promise<void> {
|
|
const response = await fetch(apiUrl(settings, path), { headers: authHeaders(settings), credentials: "include" });
|
|
if (!response.ok) {
|
|
const text = await response.text();
|
|
if (response.status === 401 && shouldNotifyAuthRequired(path)) {
|
|
notifyAuthRequired(path);
|
|
throw authExpiredError(response.statusText);
|
|
}
|
|
throw new ApiError(response.status, response.statusText, text);
|
|
}
|
|
const blob = await response.blob();
|
|
const url = URL.createObjectURL(blob);
|
|
const anchor = document.createElement("a");
|
|
anchor.href = url;
|
|
anchor.download = filename;
|
|
document.body.appendChild(anchor);
|
|
anchor.click();
|
|
anchor.remove();
|
|
URL.revokeObjectURL(url);
|
|
}
|